Support Automatic Key Rotation via the Metastore

This depends on #23

We should allow automatic rotation to be configured in the `MetaStore` such that an attempt to use an overly old key automatically (and silently) triggers creation of a new key. This will maintain the invariant that "No data is encrypted with a key older than `$ROTATION_TIME`." while not causing needless rotations when no encryption is occurring.

Start by reading the dependency in issue #23 and the MetaStore configuration and key-use paths. Trace how encryption attempts select keys and determine when a key is too old. Done means rotation is configurable, occurs silently only when encryption uses an overly old key, and preserves the stated key-age invariant without needless rotations.

Written by the indexing model from the issue text.